How to use it
- 1.Enter a URL such as
https://example.com/page, or just a domain;https://is added for you. - 2.Click Check headers. Every redirect is followed one hop at a time, up to 10 redirects.
- 3.Read the redirect chain: each step shows its status code, address and response time. Open a step to see its headers.
- 4.Review the security headers and the full response headers of the final page, and copy them if you need to share them.
What HTTP status codes mean
Every response starts with a three-digit status code. 2xx means success; 200 OK is a normal page. 3xx codes are redirects that send the browser somewhere else. 4xx codes are client errors such as 404 Not Found or 403 Forbidden, and 5xx codes mean the server failed, like 500 Internal Server Error or 503 Service Unavailable.
Headers travel with the status code. They tell the browser what the content is (Content-Type), how long it may be cached (Cache-Control), which cookies to store (Set-Cookie) and much more, all information you never see on the page itself.
Redirects: 301, 302, 307 and 308
301 Moved Permanently and 308 Permanent Redirect tell browsers and search engines that a page has moved for good, so links and rankings pass to the new address. 302 Found and 307 Temporary Redirect mean the move is temporary and the old URL stays in search results. 307 and 308 also guarantee that the request method doesn’t change, which matters for forms and APIs.
Every extra hop costs a round trip and slows down the first visit, so redirect old URLs straight to their final address: http://example.com directly to https://www.example.com/, not through two steps. Google follows up to 10 redirects in a row and browsers about 20; loops never end at all.
Security headers worth setting
Strict-Transport-Security (HSTS) makes browsers use HTTPS for your site even when someone types http://. Content-Security-Policy limits where scripts and other resources may load from, which blunts cross-site scripting. X-Content-Type-Options: nosniff stops browsers from guessing file types, and frame-ancestors or X-Frame-Options keeps other sites from framing your pages for clickjacking.
Referrer-Policy controls how much of your URLs is sent to other sites, and Permissions-Policy switches off browser features you don’t use, such as the camera or geolocation. None of them replaces secure code, but together they close common gaps with very little effort.
Questions and answers
How do I check whether a redirect is a 301 or a 302?
Enter the old URL and look at the redirect chain: every step shows its status code. 301 and 308 are permanent, 302 and 307 temporary. The chain also shows where each redirect points, so you can spot unnecessary extra hops.
How can I see the HTTP headers of a website?
Enter the address here and the full response headers of the final page are listed at the end. In a browser, open the developer tools (F12), choose the Network tab and click the first request. In a terminal, curl -I https://example.com prints the headers.
Why does this checker show different headers than my browser?
Servers can answer differently depending on the request. Your browser sends cookies, supports compression and has its own user agent, and a CDN may serve a cached or regional copy. This tool sends a plain request without cookies from our server, much like a search engine crawler does.
What causes a redirect loop?
The redirects lead back to an address that was already visited, so the browser never reaches a page and shows “too many redirects”. It’s usually two rules fighting each other (for example a CDN redirecting HTTP to HTTPS while the server redirects HTTPS back to HTTP) or a login redirect that depends on a cookie.
Which security headers should every website have?
At least Strict-Transport-Security, X-Content-Type-Options: nosniff, frame protection with frame-ancestors or X-Frame-Options, and a Referrer-Policy. A Content-Security-Policy protects best but needs testing, so start with a report-only policy and switch to enforcing it once nothing breaks.